Recent advances in integrated circuit technology have led to the proliferation of so-called system-on-a-chip (SoC) integrated circuits, where a processor is embedded with memory and other hardware blocks such as application-specific circuits on a single integrated circuit chip. FIG. 1 shows a prior art SoC system 100 including a SoC 122. SoC 122 includes a processor 102, a volatile memory 114, a non-volatile memory 110, and an application-specific circuit 116.
In addition, SoC 122 usually includes a test interface 104, such as a Joint Test Action Group (JTAG) interface, for use in debugging and testing SoC 122. Test interface 104 is generally connected to processor 102 and application-specific circuit 116, and can be connected to other circuits in SoC 122 as well. For example, test interface 104 can be used to trace the execution by processor 102 of firmware stored in volatile memory 114.
However, while useful during development, test interface 104 also provides an opening for attackers to penetrate SoC 122 once deployed in the field. For example, an attacker can use test interface 104 to copy or modify the firmware to break the security of systems in which SoC 122 is deployed. SoC 122 may employ secrets such as secret keys to prevent unauthorized access to certain resources. For example, a SoC 122 deployed in a Digital Video Disc (DVD) player/burner can employ a secret key to prevent a user from making copies of a copy-protected DVD. An attacker can use test interface 104 to obtain the secret key, and then use the DVD player/burner to make copies of copy-protected DVDs.
In addition to SoC 122, SoC system 100 usually includes an external memory 106 to store firmware and confidential data, such as private keys, device IDs, and the like, for SoC 122. But because memory 106 is external to SoC 122, hackers may be able to obtain the firmware and confidential data by monitoring the interface between external memory 106 and SoC 122.